ISO 27001 consultants help you build and prepare an information security management system (ISMS) for certification. A separate accredited certification body audits it and decides whether to certify. We compare 38 consultancies by published fee, engagement model, and region.
An ISO 27001 consultant helps your organisation define the ISMS scope, assess and treat risks, write the Statement of Applicability, implement policies and controls, and prepare evidence for audit. The consultant cannot certify you: an accredited certification body runs Stage 1 and Stage 2 and decides certification.
You need an ISO 27001 consultant when no one on your team has taken an ISMS through certification, a customer deadline is close, or your security documentation is thin. The alternative is ISO 27001 compliance software plus an internal ISMS lead who owns scope, risk decisions, and evidence. Either way, you still need an objective internal audit before certification.
4 of the 38 ISO 27001 consultancies listed here publish an ISO 27001-specific fee: gap or readiness assessments from £1,950 or CA$3,500, implementation from £7,000 or US$4,000, and internal audits from £4,500, US$1,000 or CA$3,000. These are published starting prices for defined scopes, not a market average. UK prices exclude VAT, and Canadian prices exclude tax.
| Firm | Published fee | What it covers | Source |
|---|---|---|---|
| Gap or readiness assessment (2 firms) | |||
| Goldline Consultancy | £1,950 Starting price per assessment, excluding VAT | Fixed-scope diagnostic against ISO 27001:2022 covering the proposed certification scope, Annex A gaps, existing documentation, and an indicative timeline | Published price ↗ |
| traztech | CA$3,500 Starting price per gap analysis, in Canadian dollars before tax | Phase 1 gap analysis for an ISO 27001 readiness programme; Phase 2 remediation is scoped from its findings | Published price ↗ |
| Implementation (2 firms) | |||
| Axipro | US$4,000–US$5,500 Fixed package price by headcount: $4,000 under 50 employees, $5,500 over 50 | Single-framework ISO 27001 or SOC 2 package: policies, risk assessment and treatment, control implementation, internal audit support, and audit readiness over about six weeks | Published price ↗ |
| Goldline Consultancy | £7,000 Fixed fee per engagement, excluding VAT | ISMS implementation to audit readiness for a single legal entity, up to 50 people in scope, one site or cloud hosted, with support through Stage 1 and Stage 2 | Published price ↗ |
| Internal audit (4 firms) | |||
| Axipro | US$1,000–US$2,000 Starting price by headcount: from $1,000 for 1 to 10 employees, from $1,500 for 12 to 50, from $2,000 for 50 to 100 | Remote ISO 27001 internal audit with a findings report and remediation action plan template | Published price ↗ |
| Goldline Consultancy | £4,500 Starting price per audit, excluding VAT | Independent clause 9.2 internal audit of an ISMS, priced by boundary size and control set | Published price ↗ |
| traztech | CA$3,000 Starting price per audit, in Canadian dollars before tax | Independent clause 9.2 internal audit ahead of certification or surveillance: plan, fieldwork, report, and a check of corrective actions | Published price ↗ |
| Illumen | US$10,000 Fixed launch price per audit | Full ISO 27001 internal audit for certification preparation or annual compliance, with findings and a remediation roadmap | Published price ↗ |
| Pre-certification mock audit (1 firm) | |||
| Goldline Consultancy | £3,500 Starting price per audit, excluding VAT | Mock Stage 1 and Stage 2 audit of your ISO 27001 ISMS (or another single standard Goldline supports) by a senior practitioner, ending in a ready, remediate, or reschedule verdict | Published price ↗ |
| Managed ISMS retainer (1 firm) | |||
| Goldline Consultancy | £1,450 Starting price per month, 12-month minimum, excluding VAT | Single-standard retainer, such as ISO 27001: 12 practitioner hours a month for surveillance audit support, certification renewal, governance upkeep, and three security questionnaires a quarter | Published price ↗ |
For a whole programme, software vendors publish higher estimates. Vanta's ISO 27001 consultant guide puts a consultant for the entire process at $35,000 to $40,000, and Secureframe's October 2025 guide cites $1,400 to $1,800 a day and about $38,000 in total to reach compliance. These are software vendors' estimates, not consultant quotes. The certification body bills separately for Stage 1, Stage 2, and surveillance; budget those lines with the ISO 27001 certification cost guide.
Under ISO/IEC 17021-1, a certification body must not offer management system consultancy, so the firm that builds your ISMS cannot certify it. Why the two roles stay separate.
An advisory consultant guides your team; a hands-on engagement assigns implementation work to the provider. Agree the outputs and owners before comparing fees.
| Your situation | Engagement to request | Output to agree |
|---|---|---|
| You need to understand the gaps | Gap assessment | Defined ISMS scope, findings, priorities, and a remediation plan with owners |
| You need to build the ISMS | Implementation or advisory support | Risk assessment, treatment plan, Statement of Applicability, policies, controls, and operating evidence; name who does each task |
| Your system needs an independent check | Internal audit | Audit plan, objective review, findings, and corrective-action follow-up; confirm independence from the work audited |
| You need to keep the ISMS working | Maintenance or managed support | Risk and policy updates, evidence reviews, management-review support, and agreed surveillance preparation |
For the external audit, use the certification-body directory. For a full budget including surveillance, use the certification cost guide.
Two UK picks for certification support and combined ISO/pentest work, plus US options for dual-framework readiness, internal audit, and broader compliance programmes. Match the engagement to the work you need done.
URM Consulting suits UK organisations seeking certification support: it reports helping more than 400 organisations achieve ISO 27001 certification and provides both consultancy and advisory support. Ask which implementation tasks its proposal assigns to your team.
Source: URM ISO 27001 services ↗ · evidence checked
Precursor Security suits UK organisations buying ISO 27001 consultancy and CREST-accredited penetration testing from one provider. Its published services also include a 24/7 UK SOC. The prices shown cover testing and managed security, not ISO implementation.
Source: Precursor services and credentials ↗ · evidence checked
Control and Function suits US SaaS teams of roughly 10–60 people comparing SOC 2 and ISO 27001 readiness together. Its platform-neutral service offers coaching and hands-on readiness support, with a separate auditor. Confirm the dual-framework scope in the quote; the published starting prices describe readiness packages.
Source: Control and Function readiness packages ↗ · evidence checked
Illumen suits smaller organisations that need an ISO 27001 internal audit alongside GRC-platform implementation or vCISO support. Its published $10K launch price is for internal audit, not a full implementation or certification audit. Confirm current availability and how the auditor remains objective about work Illumen helped implement.
Source: Illumen internal audit and GRC services ↗ · evidence checked
Tevora suits organisations coordinating ISO 27001 with SOC 2, PCI DSS, HIPAA, HITRUST, or CMMC. Its services cover compliance, security testing, and executive CISO support. Request a proposal that separates ISO implementation from any assessment or certification services.
Source: Tevora compliance services ↗ · evidence checked
Narrow by how a firm works and where it says it serves clients. Confirm coverage, named practitioners, and the ISO-specific scope in a proposal. Listed verified-first, then alphabetically.
Regions reflect stated service coverage, not headquarters. Broad labels such as “Global” stay separate, and overlapping labels share one option (for example, “Europe or EU”); confirm your location with the firm. Missing coverage or model details remain “Not published.”
Showing 38 firms.
No firms match these filters and search. Reset the controls to see every independent firm, or get matched anonymously instead.
List or upgrade your firm on this page →
Your market decides which accreditation body stands behind the certificate, what currency the quote is in, and which frameworks usually come with ISO 27001. Counts below use each firm's stated service regions or headquarters; confirm coverage for your location.
11 listed consultancies are based in the UK or state UK coverage: Axipro, Goldline Consultancy, Cypro, Precursor Security, Romano Security Consulting, Securis360, URM Consulting, Cybervantage 360, and 3 more in the filterable directory. UKAS accredits UK certification bodies, so ask which UKAS-accredited body the consultant expects to work with. Goldline Consultancy publishes 5 ISO 27001 fee lines in pounds, excluding VAT, in the fee table. UK buyers often pair ISO 27001 with Cyber Essentials, the government-backed baseline certification, so ask whether the consultancy prepares both.
Public-sector buyers can buy ISO 27001 consultancy that relates to cloud services through G-Cloud 15, the framework run by the Government Commercial Agency (formerly Crown Commercial Service) since 6 August 2026, where suppliers list it as a cloud support service on the Digital Marketplace. Consultancy unrelated to cloud services goes through other frameworks, such as Management Consultancy 4. Framework details checked 5 October 2026.
28 listed consultancies are based in the US or state US coverage: Axipro, Illumen, traztech, Archlight, BEMO, Control and Function, Coral Esecure, Cycore, and 20 more in the filterable directory. ANAB accredits US certification bodies for ISO 27001. Axipro and Illumen publish ISO 27001 fees in US dollars. US SaaS companies often run SOC 2 and ISO 27001 as one programme; compare the CPA firms and certification bodies in SOC 2 and ISO 27001 auditors.
Of the listed consultancies, 5 cover India (Coral Esecure, Isecurion, Securis360, Cybervantage 360 and Illume Intelligence), 5 cover the Middle East (Archlight, Axipro, Isecurion, Securis360 and Illume Intelligence), and 5 cover Asia-Pacific (Axipro, Cyber Forte, SECNORA, Securis360 and Illume Intelligence). Ask which accredited certification bodies the consultant has worked with in your market, and whether your customers recognise that accreditation.
For an implementation engagement, agree who produces the ISMS scope, risk assessment and treatment plan, Statement of Applicability, policies, controls, and operating evidence. Arrange an objective internal audit and management review before a separate accredited certification body runs Stage 1 and Stage 2. A gap assessment or internal-audit-only engagement has a narrower deliverable.
| Work product | Consultant | Certification body |
|---|---|---|
| Scope and Statement of Applicability | Writes and maintains with your team | Reviews at Stage 1 |
| Risk assessment and treatment | Runs the method and records treatment decisions | Samples the records at Stage 2 |
| Internal audit and management review | Supports management review; arranges an objective internal audit | Must remain independent of that work |
| Stage 1 and Stage 2 | Prepares evidence and attends | Performs the audits |
| Certificate | Cannot issue | Issues if Stage 2 passes, then returns for surveillance |
The certification body needs evidence that your ISMS operates: risk decisions, access reviews, incident handling, internal-audit findings, and management actions. Policies alone do not demonstrate that. Agree whether the consultant implements controls alongside your team or advises your staff, how it prepares evidence for audit, and when its support ends.
Compare proposals against the same scope and responsibilities. A useful quote names the outputs, the practitioner doing the work, what your staff must supply, and what costs extra. Ask for redacted samples before signing.
| Proposal line | Provider commitment | Your responsibility or question |
|---|---|---|
| Outputs and scope | List the gap report, scope, risk assessment, treatment plan, SoA, policies, and evidence handover included | Confirm products, legal entities, sites, controls, and deadlines in scope |
| Named owners | Name the lead practitioner, relevant ISO experience, and who writes or implements each deliverable | Assign your ISMS owner, control owners, technical changes, and management approval |
| Samples | Provide a redacted gap report, Statement of Applicability, and audit report | Check for risk-specific decisions, useful findings, and clear corrective actions |
| Internal audit | Explain the audit scope, auditor competence, and objectivity safeguards | Ask whether a separate practitioner audits controls the provider helped build; management owns the review and actions |
| Exclusions and changes | Separate software, training, technical remediation, travel, certification fees, extra sites, and rework | Confirm what is included and agree change rates and approval before work expands |
| Ongoing support | Specify Stage 1/2 attendance, finding closure, maintenance, and year-two/year-three surveillance support | Confirm which support is included, separately priced, or ends after the initial handover |
Check credentials against the service you are buying. CREST accreditation supports specific security-testing services; NCSC Cyber Advisor assurance covers that scheme’s advisory work. Neither authorises a consultant to issue an ISO 27001 certificate. Choose the accredited certification body separately.
Yes. Member firms of Deloitte, PwC, EY, and KPMG publish ISO 27001 implementation or ISMS advisory services. A Big 4 engagement fits a large, multi-entity, or regulated scope, or an organisation with an existing Big 4 relationship. A boutique ISO 27001 consultancy usually fits a single-entity scope, a fixed budget, and a named practitioner better.
Services vary by member firm; examples include Deloitte Ireland, PwC Belgium, EY Czech Republic, and KPMG Germany. If the same firm audits your financial statements, check the auditor-independence rules that apply to you before buying advisory work from it. Some Big 4 networks also certify or audit ISO management systems: EY operates the accredited certification body EY CertifyPoint, and KPMG Germany audits ISO 27001 on the basis of IT-Grundschutz. Confirm that the body certifying your ISMS is independent of the team that advised on it.
ISO 27001 certification rests on the independence of the certification body. ISO/IEC 17021-1 requires that a certification body, and any part of the same legal entity, must not offer management system consultancy. A body that audits a system its own colleagues built cannot be impartial about it. When one firm offers to both implement and certify, treat it as a red flag rather than a convenience.
In practice this means two contracts and two invoices. The consultant helps prepare the ISMS. A certification body accredited for ISO 27001 by an accreditation body such as UKAS in the United Kingdom or ANAB in the United States runs Stage 1 and Stage 2 and decides certification. Compare those bodies in the certification-company directory and confirm that your customers accept the accreditation. Internal-audit objectivity is a separate check: appoint competent auditors who can review the work impartially, including controls the consultant helped implement.
Hire the ISO 27001 consultant first for the gap assessment and implementation, then select the certification body early enough to book Stage 1 once the ISMS is operating. Certification bodies set their own audit dates, so request their quotes while implementation is under way. Compare accredited bodies in the certification-company directory.
You pay the consultant to build and prepare the ISMS, then a separate accredited certification body for Stage 1, Stage 2, and surveillance. Those are two invoices on purpose: ISO/IEC 17021-1 forbids the same legal entity from consulting on and certifying the same system.
The consultant fee depends on scope, headcount, sites, current maturity, and how much implementation your team does itself; the published starting prices in the fee table above show what each defined scope buys. The certification body prices its own Stage 1 and Stage 2 audit and the surveillance cycle. Ask every finalist for line items and compare them against the ISO 27001 certification cost source ledger, which separates the six cost classes without inventing an average. Ask about VAT or other taxes, currency, software, technical remediation, and external certification fees.
Yes. Ask a consultant to map shared controls to both frameworks and identify the extra ISO management-system work. Reusing access reviews, change management, vulnerability management, and incident-response evidence can reduce duplicate work; deadlines and audit scope still determine the sequence.
ISO 27001 needs the risk assessment, Statement of Applicability, internal audit, and management review. SOC 2 needs evidence mapped to the Trust Services Criteria and a licensed CPA firm to attest to it. The consultant prepares the agreed work and hands off to the appropriate independent providers. Compare the frameworks in the SOC 2 versus ISO 27001 guide and the external providers in SOC 2 and ISO 27001 auditors. If your next customer needs only one assurance, agree which deliverable comes first rather than paying for an unnecessary parallel deadline.
Inclusion requires a service-firm record explicitly tagged for ISO 27001. “Verified” means the firm and the published fields in its directory record were checked on the shown source date; it does not certify proposal quality or guarantee an outcome. The base directory stays verified-first, then alphabetical.
Use-case picks compare documented services and buyer fit. Each pick shows a source and the date of the relevant fact check. Region filters use stated service coverage, not office location; engagement-model filters use published descriptions. The fee table lists only ISO 27001-specific prices that a listed firm publishes on its own site, in the published currency, with the date each price was checked; we do not convert or average them. Missing fields remain “Not published.” Page reviewed 5 October 2026; older firm checks retain their dates. Read the full methodology.
Hire these roles separately. ISO/IEC 17021-1 requires that a certification body, and any part of the same legal entity, must not offer management system consultancy. A firm that both implements and certifies the same ISMS is a conflict of interest, not a shortcut.
| Factor | ISO 27001 consultant | Accredited certification body |
|---|---|---|
| You hire them to | Scope, build, and prepare the ISMS | Audit the ISMS and decide certification |
| Core deliverables | Gap analysis, risk treatment, Statement of Applicability, policies, internal audit | Stage 1 document review, Stage 2 operating audit, certificate |
| Can issue the certificate? | No | Yes, inside accredited scope |
| Independence rule | Must hand off to a separate accredited body | Must not have consulted on the same ISMS |
| Next directory | The consultant list on this page | The separate certification-body directory |
The certification path runs from ISMS scoping and implementation through internal audit, management review, Stage 1, Stage 2, and later surveillance. Agree which stages your consultant supports. A separate accredited certification body conducts the external audits and decides certification.
Define the boundary of the Information Security Management System, then assess the current state against ISO 27001:2022 and its Annex A controls. The output is a prioritized remediation plan and a defensible scope statement.
Run the risk assessment and treatment plan, produce the Statement of Applicability that justifies each Annex A control, and implement policies and technical controls. This is the heaviest phase and where a hands-on practitioner earns the fee.
Complete an objective internal audit and a documented management review. The consultant may help prepare the review and address findings, but the audit must be impartial about the work being examined. Closing internal findings reduces risk; Stage 2 can still identify new nonconformities.
The accredited certification body reviews documentation at Stage 1 and the operating ISMS at Stage 2, then decides certification. It returns for surveillance through the three-year cycle. Specify whether consultant support covers those audits, corrective actions, and later ISMS maintenance.
The framework, cost, independence, and consultant-versus-tooling questions to settle before you sign with an ISO 27001 consultant.
Send your scope, target markets, and timeline. We’ll help you find support for implementation, certification, or a coordinated ISO 27001 and SOC 2 program.
Menu